Introduction: Real Impact and Significance
An attacker with resource administrator credentials on F5 BIG-IP can cross the Appliance mode security boundary and get a bash shell. Appliance mode is a core defense that critical infrastructure operators rely on, and this flaw undermines it. Organizations that use BIG-IP to enforce strict administrative separation and compliance requirements are directly affected.
F5 Networks is a leading provider of application delivery controllers and security appliances. Its BIG-IP platform runs in financial services, government, healthcare, and large enterprises worldwide. Because so much global application delivery and security depends on BIG-IP, a vulnerability in its core management interfaces carries serious consequences for the broader tech ecosystem.
Technical Information
CVE-2025-61958 is a privilege escalation vulnerability in the iHealth command of the tmsh (Traffic Management Operating System Shell) utility on F5 BIG-IP systems. An authenticated attacker with at least the resource administrator role can bypass tmsh command restrictions and obtain a bash shell. The problem is most serious on BIG-IP systems running in Appliance mode, which exists specifically to prevent direct shell access and to keep a strict security boundary between administrative users and the underlying operating system.
The root cause is improper input validation or command injection in the iHealth utility, which processes diagnostic commands and generates qkview files for system health analysis. When an attacker sends crafted input to the iHealth command, tmsh does not sanitize it properly, and the attacker can escape the restricted shell and run arbitrary bash commands. That breaks the intended privilege separation and lets the attacker escalate to full system-level access. The vulnerability is classified under CWE-250 (Execution with Unnecessary Privileges).
No public code snippets or proof of concept exist for this vulnerability. The mechanism resembles other recent tmsh command injection issues in F5 products, but neither F5 nor external researchers have published exploit details.
Affected Systems and Versions
CVE-2025-61958 affects F5 BIG-IP systems where the iHealth command is available through tmsh. It is most severe on systems running in Appliance mode, which is meant to limit administrative access to the tmsh environment alone. The advisory does not list exact version numbers or ranges, but it notes that F5 evaluated only supported versions. Versions that have reached End of Technical Support (EoTS) were not evaluated and may also be vulnerable.
Vendor Security History
F5 Networks has a history of critical vulnerabilities in its BIG-IP product line, including:
- CVE-2020-5902: Remote code execution in the Traffic Management User Interface (TMUI), widely exploited in 2020.
- CVE-2023-46747: Command injection in TMUI, exploited by advanced persistent threat actors.
- CVE-2025-20029: Command injection in tmsh, with public proof of concept code.
F5 usually publishes advisories quarterly, with detailed mitigation guidance. Still, the repeated privilege escalation and command injection flaws in tmsh and related management components point to ongoing problems with secure software development and input validation.
